3 ms·

> an attacker between you and your DNS server could determine which sites you are attempting to communicate with just by reading packets on the network. This b

> an attacker between you and your DNS server could determine which sites you are attempting to communicate with just by reading packets on the network. This buys the attacker very little. If they can see the packets on your network to read your DNS traffic, then they already know what servers you are communicating with.

vbezhenar 8y ago
If you can see that I'm communicating with cloudflare IP, it doesn't tell you very much. There are thousands of websites behind that IP. If you can see that I resolved some specific domain to that IP just before I started to send packets to that IP, you know probably I'm communicating with that specific domain.
- detaro 8y ago
  Currently, I can also just look at the packets you are sending to that Cloudflare IP and read the domain you're asking for.
  - vbezhenar 8y ago
    If you're talking about SNI records in TLS handshake, it'll be fixed soon.
  - zamadatix 8y ago
    "you should fix that front right flat on your car" "yeah but there is a flat on the front left so what does it matter" This style response is what I keep seeing whenever a new security enhancement to DNS and TLS is announced. Yes, today 2 things are broken... but that means two things need to be fixed not that this new fix is foolish/useless/shouldn't be implemented. Now if you have particular takes against the way the problem was solved that'd be a more serious conversation.
    - detaro 8y ago
      Fair enough, I probably deserve that response, especially since the TLS fix is apparently closer than I thought. DNSSEC brings quite a bit of complexity and potential to break things while in a way further centralizing control (with CAs, at least there's multiple to choose from), so without the second half it seemed like a small gain at high cost.
  - woofcat 8y ago
    If you're running Firefox Nightly and using DNS over HTTPS or TLS it's now an completely encrypted tunnel as Cloudflare and FireFox have deployed encrypted SNI. https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/ So with this combo you would be unable to determine which HTTPS sites I am visiting that are hosted on Cloudflare.
djrogers 8y ago
You’re looking at the wrong end of an attack here - it’s true that an attacker targeting you gains very little, ut an attacker targeting the DNS resolver gains knowledge about everyone using that resolver.

vbezhenar 8y ago

If you can see that I'm communicating with cloudflare IP, it doesn't tell you very much. There are thousands of websites behind that IP. If you can see that I resolved some specific domain to that IP just before I started to send packets to that IP, you know probably I'm communicating with that specific domain.

detaro 8y ago
Currently, I can also just look at the packets you are sending to that Cloudflare IP and read the domain you're asking for.
- vbezhenar 8y ago
  If you're talking about SNI records in TLS handshake, it'll be fixed soon.
- zamadatix 8y ago
  "you should fix that front right flat on your car" "yeah but there is a flat on the front left so what does it matter" This style response is what I keep seeing whenever a new security enhancement to DNS and TLS is announced. Yes, today 2 things are broken... but that means two things need to be fixed not that this new fix is foolish/useless/shouldn't be implemented. Now if you have particular takes against the way the problem was solved that'd be a more serious conversation.
  - detaro 8y ago
    Fair enough, I probably deserve that response, especially since the TLS fix is apparently closer than I thought. DNSSEC brings quite a bit of complexity and potential to break things while in a way further centralizing control (with CAs, at least there's multiple to choose from), so without the second half it seemed like a small gain at high cost.
- woofcat 8y ago
  If you're running Firefox Nightly and using DNS over HTTPS or TLS it's now an completely encrypted tunnel as Cloudflare and FireFox have deployed encrypted SNI. https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/ So with this combo you would be unable to determine which HTTPS sites I am visiting that are hosted on Cloudflare.

djrogers 8y ago

You’re looking at the wrong end of an attack here - it’s true that an attacker targeting you gains very little, ut an attacker targeting the DNS resolver gains knowledge about everyone using that resolver.